graphql-http 1.3.0 → 1.4.0

package/README.md

@@ -190,11 +190,7 @@ fastify.all('/graphql', async (req, res) => {
       url: req.url,
       method: req.method,
       headers: req.headers,
-      body: await new Promise((resolve) => {
-        let body = '';
-        req.on('data', (chunk) => (body += chunk));
-        req.on('end', () => resolve(body));
-      }),
+      body: req.body, // fastify reads the body for you
       raw: req,
     });
     res.writeHead(init.status, init.statusText, init.headers).end(body);

package/lib/handler.d.ts

@@ -32,7 +32,13 @@ export interface Request<RawRequest, Context> {
     readonly method: string;
     readonly url: string;
     readonly headers: RequestHeaders;
-    readonly body: string | Record<string, unknown> | null;
+    /**
+     * Parsed request body or a parser function.
+     *
+     * If the provided function throws, the error message "Unparsable JSON body" will
+     * be in the erroneous response.
+     */
+    readonly body: string | Record<string, unknown> | null | (() => string | Record<string, unknown> | null | Promise<string | Record<string, unknown> | null>);
     /**
      * The raw request itself from the implementing server.
      *

package/lib/handler.js

@@ -142,16 +142,21 @@ function createHandler(options) {
                         if (!req.body) {
                             throw new Error('Missing body');
                         }
+                        let data;
                         try {
-                            const data = typeof req.body === 'string' ? JSON.parse(req.body) : req.body;
-                            partParams.operationName = data.operationName;
-                            partParams.query = data.query;
-                            partParams.variables = data.variables;
-                            partParams.extensions = data.extensions;
+                            const body = typeof req.body === 'function' ? await req.body() : req.body;
+                            data = typeof body === 'string' ? JSON.parse(body) : body;
                         }
-                        catch (_d) {
+                        catch (err) {
                             throw new Error('Unparsable JSON body');
                         }
+                        if (!(0, utils_1.isObject)(data)) {
+                            throw new Error('JSON body must be an object');
+                        }
+                        partParams.operationName = data.operationName;
+                        partParams.query = data.query;
+                        partParams.variables = data.variables;
+                        partParams.extensions = data.extensions;
                         break;
                     }
                 default: // graphql-http doesnt support any other content type
@@ -229,7 +234,7 @@ function createHandler(options) {
                 throw null;
             operation = ast.operation;
         }
-        catch (_e) {
+        catch (_d) {
             return makeResponse(new graphql_1.GraphQLError('Unable to detect operation AST'), acceptedMediaType);
         }
         if (operation === 'subscription') {

package/lib/handler.mjs

@@ -138,16 +138,21 @@ export function createHandler(options) {
                         if (!req.body) {
                             throw new Error('Missing body');
                         }
+                        let data;
                         try {
-                            const data = typeof req.body === 'string' ? JSON.parse(req.body) : req.body;
-                            partParams.operationName = data.operationName;
-                            partParams.query = data.query;
-                            partParams.variables = data.variables;
-                            partParams.extensions = data.extensions;
+                            const body = typeof req.body === 'function' ? await req.body() : req.body;
+                            data = typeof body === 'string' ? JSON.parse(body) : body;
                         }
-                        catch (_d) {
+                        catch (err) {
                             throw new Error('Unparsable JSON body');
                         }
+                        if (!isObject(data)) {
+                            throw new Error('JSON body must be an object');
+                        }
+                        partParams.operationName = data.operationName;
+                        partParams.query = data.query;
+                        partParams.variables = data.variables;
+                        partParams.extensions = data.extensions;
                         break;
                     }
                 default: // graphql-http doesnt support any other content type
@@ -225,7 +230,7 @@ export function createHandler(options) {
                 throw null;
             operation = ast.operation;
         }
-        catch (_e) {
+        catch (_d) {
             return makeResponse(new GraphQLError('Unable to detect operation AST'), acceptedMediaType);
         }
         if (operation === 'subscription') {

package/lib/utils.d.ts

@@ -5,7 +5,7 @@
  */
 import type { ExecutionResult, GraphQLError } from 'graphql';
 /** @private */
-export declare function isObject(val: unknown): val is Record<PropertyKey, unknown>;
+export declare function isObject(val: unknown): val is Record<PropertyKey, any>;
 /** @private */
 export declare function areGraphQLErrors(obj: unknown): obj is readonly GraphQLError[];
 /** @private */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphql-http",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Simple, pluggable, zero-dependency, GraphQL over HTTP Protocol compliant server and client",
   "keywords": [
     "graphql",